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Summary 
IAB Europe, the European-level association for the digital marketing and advertising ecosystem, has 
taken note of the Guidelines 8/2020 on the targeting of social media users, adopted by the European 
Data Protection Board (EDPB) on 2 September 2020. We hereby submit our response to the public 
consultation on the guidelines. In particular: 
e We welcome efforts by the EDPB to understand the digital advertising ecosystem and provide 
legal certainty through the elaboration of EU-level interpretation to applicable EU rules. 
e Weare, nevertheless, concerned about the EDPB’s failure to acknowledge the benefits of ad 
targeting, its position on the legitimate interest legal basis, joint controllership and the overall 
negative legal and political discourse developed by the EDPB on targeting. 


IAB Europe 

IAB Europe represents 25 European national associations who in turn associate over 5,000 companies 
from across the digital advertising and marketing ecosystem, from advertisers and advertising agencies 
on the buy side, news publishers and other ad-funded sites and online services on the sell side, and 
technology providers facilitating the delivery of ads. It also has 90 companies in direct membership, 
including agencies, technology companies, publishers and eCommerce companies. 


IAB Europe represents the broader digital advertising ecosystem beyond targeting in the context of 
social media. Our contribution to the present consultation therefore aims at providing feedback to the 
extent the Guidelines are susceptible to affect the industry as a whole and by analogy. 


IAB Europe welcomes... 
1. The recognition of targeted advertising as a legitimate business activity 


We take a positive view of the EDPB’s inherent acknowledgment of the ad-supported business model 
and recognition of the fact that personal data can be processed legally for its purposes in line with the 
rules established by the General Data Protection Regulation (GDPR). The GDPR should not be 
interpreted as prohibiting specific business models but is precisely about creating a safe space for users, 
giving them extensive rights and ensuring they can make choices about how their data is processed. This 
puts them in a better position to elect to have their data processed in exchange for valuable services, 
and this value exchange should be preserved provided that the user’s rights and interests are protected. 
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2. Acknowledgement of the ecosystem’s complexity 
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We welcome the acknowledgement by the EDPB that the digital advertising ecosystem is “complex and 
evolving” (para. 26) and that it comprises multiple actors with varying functions. In particular, we view 
positively efforts by the EDPB to provide harmonised EU-level guidance that clarifies the roles and 
responsibilities of the various actors, minimises reliance on potentially divergent national guidance 
impacting digital advertising, and improves legal certainty through uniform interpretations that enable 
the GDPR to fully deliver on its promise of creating a unified privacy and data protection regime. 


IAB Europe is concerned about... 
1. The EDPB’s negative discourse on targeted advertising and lack of transparency 


We are concerned by the pervasiveness, throughout the Guidelines, of some general themes and 
conclusions about the negative effects of targeted advertising on transparency, fundamental rights as 
well as its apparently inherent manipulative effect on users. These appear to be driven by a number of 
very general and unsubstantiated statements as well as self-serving examples (see for instance, 
paragraph 4 on lack of transparency and control, example 8 on page 23 and example 14 on page 32), 
that enable the EDPB to draw fundamentally biased conclusions of a political nature, and generate 
apparent obligations better suited for the remit of legislative action, rather than that of a guidance 
document published by the Board. As an independent body, the EDPB needs to take a more balanced 
approach which also acknowledges the benefits of targeting more clearly to avoid a risk of bias or undue 
influence. 


In particular, we would urge the EDPB to be cautious with generalisations about targeted advertising 
related to transparency and control and would like to draw the Board’s attention to prominent industry- 
driven approaches to legal compliance, designed to provide full user transparency and control over the 
collection and processing of their personal data for targeted advertising purposes. 


An important example of this is IAB Europe’s Transparency & Consent Framework (TCF)?, which ensures 
through standardisation, that consumers as well as industry actors, benefit from transparency and 
control where personal data is processed in connection with the delivery and measurement of 
advertisements or the personalisation of editorial content. This is inter alia achieved through the 
provision of all relevant information directly on the screen interactively and, where appropriate, through 
layered notices as advocated by EDPB in the Guidelines (para. 84). 


Instruments such as TCF offer a better way of informing users through notices and messaging that 
efficiently deliver relevant information within the meaning of articles 12-14 GDPR (such as on types of 
data processed, processing purposes and identity of third parties), including on how to access more 


1 For more information on IAB Europe’s Transparency & Consent Framework (TCF), see www.iabeurope.eu/tcf. 
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detailed information, rather than exhaustively describing all underlying and subsequent processing from 
the outset as suggested by EDPB in paragraphs 4 and 87 of the Guidelines. 


2. The EDPB’s failure to acknowledge the benefits of targeted advertising 


It is unfortunate that the EDPB fails to explicitly recognize the benefits of targeting and targeted 
advertising, while persistently articulating a negative discourse and drawing conclusions of a political 
nature regarding the alleged negative effects of such practices throughout the Guidelines (e.g., paras. 4, 
12, 13, 14). In particular, the EDPB should recognise that while these Guidelines only refer to social 
media targeting, there is an inherently larger (and more localised) industry that benefits from targeted 
advertising, to which the EDPB’s considerations may apply by analogy and affect disproportionately. 


Targeted advertising data has been shown to make users over five times more likely to click on an 
advertisement in comparison with run-of-network advertising or contextual targeting”, which increases 
the value of advertising space on websites. This allows media companies to build more sustainable 
digital business models in light of an already challenging time for traditional print businesses. It can also 
prove instrumental to the survival of smaller publishers and those with quality content that draws 
visitors but not many advertisers, including by reducing the overall cost of advertising. Providing quality 
news, content and services for free is a significant challenge, as European internet users generally are 
unwilling to pay for online news, content and services.? In addition, providing relevant ads means that 
people don’t need to see as many ads to discover products and services they may be interested in. 


3. The EDPB’s position on legal bases 


While we welcome the Board’s underlining of the robustness of legitimate interests as a legal basis, 
recalling that it requires careful assessment of the risks at hand, we disagree with the EDPB’s exclusion 
of the opportunity for organisations to demonstrate the existence of a legitimate interest by applying 
the very conditions that the Board itself sets out. 


We contend that the choice of legal basis should not be dictated a priori but should instead, as indicated 
by the EDPB itself and reiterated many times by the CJEU’, depend on an assessment of the specific 
situation at hand. The latter could be supplemented by clear guidance that informs the process in detail 
without diminishing the flexibility of the GDPR in terms of legal bases offered, and without arbitrarily 
and disproportionately restricting digital businesses. In particular, the ability to claim a legitimate 
interest should not be excluded for all case scenarios of targeting or personalisation within a service, 


2 ‘The Economic Value of Behavioural Targeting in Digital Advertising’, IHS Markit, 2017. Available at: 
https://datadrivenadvertising.eu/wp-content/uploads/2017/09/BehaviouralTargeting FINAL.pdf. 

3 ‘Europe Online: An Experience Driven by Advertising’, GfK, 2017. Available at: 
https://datadrivenadvertising.eu/wp-content/uploads/2017/09/EuropeOnline FINAL.pdf. 

4 See CJEU, cases C-131/12, Google Spain, para. 74, C-13/16, Rigas, C-708/18, Asociata M5A-ScaraA. 
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notably where adequate transparency, case-specific balancing tests and the availability of a right to 
object have been adequately implemented, for instance through instruments such as TCF. 


4. The EDPB’s discourse on the potential for unfair discrimination 


We are concerned about the speculative conclusions regarding the use of the capabilities of ad targeting 
tools to unfairly discriminate on the basis of special categories of personal data. For example, Section 3 
of the Guidelines suggests that targeted advertising related to job offers, housing or credit can 
systematically discriminate against certain groups of people (para. 10). This view does not take into 
account whether or not a job posting, or credit provider is available and publicly accessible. It would not 
be in the interest of those targeters to exclude access to any social media users that may be interested 
in the services or job postings they are offering. To be clear, IAB Europe and its members do not support 
the use of targeted advertising in a way that leads to unfair discrimination. Our concern is that the way 
some examples are highlighted in the Guidelines creates the false impression that these are commonly 
accepted practices in the targeted advertising industry. 


Further, paragraph 11 insinuates that the mere act of targeting content or advertising undermines a 
social media user’s individual autonomy and freedom by influencing their thought process, emotions 
and behaviour. This is extremely speculative and has no place in official guidance documentation of the 
EDPB. 


Paragraph 14 is similarly speculative and biased in suggesting that if an individual gets the “feeling” that 
their behaviour is being systematically monitored, it may have a chilling effect on their freedom of 
expression, as a result of targeted advertising or other (online) messaging. These statements 
demonstrate a very one-sided, unbalanced view that fails to recognise the extent to which digital 
advertising has pioneered the better addressability of audiences in a benign way that, far from harming 
users’ fundamental rights, often benefits them. For example, instead of relying just on broad 
demographic segments, digital advertising can use information about users’ online behaviour to assign 
them to large segments, or “audiences”, that all share common interests, and because of those common 
interests, may be interested in a specific good or service. 


5. The EDPB’s broad view on the scope of article 22 GDPR 


We are concerned about the suggestion in paragraphs 80-81 that profiling by social media providers for 
targeting can trigger the application of article 22 GDPR. This is not helpful guidance because it implies 
that the mere targeting of ads about online betting sites is de facto ‘dangerous’ and therefore must be 
subject to restrictions, beyond those already applicable to what is typically a heavily regulated sector at 
Member State level. Without the use of technologies such as ad targeting, there is no method with 
which a social media provider can actually ensure that those advertisements are shown only to persons 
for which the ads are appropriate, for example those above a certain age. 
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The extension of the application of article 22 to recommended content is even more problematic. In 
order to present users with new content they may find useful or relevant, many services rely ona 
variety of signals — e.g., viewing history, subscriptions, followers — to recommend content. This practice 
is fundamentally different from advertising and brings into question the fundamental design of nearly 
every social media platform. 


Similar to the issue highlighted above regarding paragraph 10 of the Guidelines, IAB Europe doesn’t 
consider that the problem is one of legal interpretation — rather, the issue is the type of advertisement 
that the EDPB subjectively considers to be appropriate or not appropriate, which is a matter that goes 
beyond the scope of its remit. 


6. The EDPB’s stance on joint controllership 


Generally, we are concerned with the Board’s expansive view on the criteria for joint controllership and 
related requirements. The EDPB should adopt a stance on joint controllership that aligns with (and does 
not go beyond) the obligations stipulated in the GDPR and established case-law on the topic? and leaves 
adequate space for controller / processor relationships (also embodied in the Regulation) to develop. In 
particular, joint controllership should not be considered as established a priori where tools are merely 
put at the disposal and choice of the targeter and should clearly be delimited solely to the joint purposes 
pursued and assessed on a case-by-case basis. It should also be recognised that one of the entities 
involved can pursue additional purposes where an appropriate separate legal basis has been established 
in a way that does not necessarily extend joint controllership “until deletion of the data” as suggested in 
paragraph 57. 


In addition, the approach suggested in these Guidelines with regard to the level of arrangements on the 
respective responsibilities of joint controllers (paras. 124, 127) and the extent to which such 
arrangements must be made available to the user (para. 87, 91) should be aligned with requirements 
under GDPR. The Regulation indeed only requires that the “essence of the arrangement” be made 
available (article 26) and already contains extensive obligations with regard to information, security of 
processing, DPIA and privacy-by-design, which apply to each of the controllers individually. 


5 See e.g., CJEU, case C-210/16, Wirtschaftsakademie Schleswig-Holstein and CJEU, case C-40/17, Fashion ID. 


